Messages in this thread | | | Date | Tue, 10 Nov 2009 07:49:56 -0800 | From | Kees Cook <> | Subject | Re: [PATCH v4] [x86] detect and report lack of NX protections |
| |
On Mon, Nov 09, 2009 at 03:16:16PM -0800, H. Peter Anvin wrote: > On 11/09/2009 02:10 PM, Kees Cook wrote: > > diff --git a/arch/x86/mm/setup_nx.c b/arch/x86/mm/setup_nx.c > > index 513d8ed..1b93231 100644 > > --- a/arch/x86/mm/setup_nx.c > > +++ b/arch/x86/mm/setup_nx.c > > @@ -53,6 +53,9 @@ void __init set_nx(void) > > #else > > void set_nx(void) > > { > > + /* notice if _PAGE_NX exists and was removed during check_efer() */ > > + if (_PAGE_NX && ((__supported_pte_mask & _PAGE_NX) == _PAGE_NX)) > > + nx_enabled = 1; > > } > > #endif > > > > The second clause can only get executed if CONFIG_X86_PAE is unset, > which in turn means _PAGE_NX == 0... so that piece of code is meaningless.
CONFIG_X86_PAE is unset for x86_64, where _PAGE_NX is valid. (This was the main situation I was trying to address.) So that chunk runs for non-pae 32bit, and all 64bit:
config X86_PAE bool "PAE (Physical Address Extension) Support" depends on X86_32 && !HIGHMEM4G
> It also looks to me that there is no message distinguishing the case > when nx_enabled == 1 but disable_nx == 1, and instead we say NX is > "active" when in fact it is disabled in the kernel.
That's true -- I had overlooked that part. New patch on the way...
-Kees
-- Kees Cook Ubuntu Security Team
| |